Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.
AnalysisAI
An issue was discovered in GNOME Evolution before 3.35.91. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value. Affected products include: Gnome Evolution. Version information: before 3.35.91..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to p
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access contr
addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow a
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing
Cross-site scripting (XSS) vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103, 7.x be
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access contr
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access contr
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access contr
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access contr
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access contr
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, al
GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted ke
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today